Identifying Reconnaissance Activity: A Strategy for Network Defence

Over recent years there has been a massive increase in the need to build stronger and more effective defensive systems in many contexts due to the amplified threat of terrorism. Network security is no exception to this increased need to secure systems against attack. One area within network security which has received a heightened interest is the correlation of reconnaissance activities, rather than merely blocking source addresses without further investigation. This paper will examine the work to date and detail how various researchers have approached the correlation of network scan activity, in relation to the detection of more overt malicious activity or network mapping. The systems that have been built contain two key components for examination: the correlation engine and the method by which data is collected and in some cases transported across the host network. After the summary of existing research this paper will then detail new work we are undertaking in this field, using clustering techniques in conjunction with a peer to peer network, to correlate port scan activity in real-time.